topic Find All fieldnames for fields which contain a specified value in Splunk Search

Find All fieldnames for fields which contain a specified value

essklau — Mon, 12 May 2014 19:06:43 GMT

Hello,

My question is whether or not I can, via sp, return a list of all fieldnames which contain a specified value.

For instance, if I was looking for "superstar", can I construct a search which will return all fields which contain "superstar" as a value?

Thanks

Re: Find All fieldnames for fields which contain a specified value

martin_mueller — Mon, 12 May 2014 21:06:35 GMT

Sure. With splunkd being our superstar, you can do this:

index=_internal | fields - tag::*
| foreach * [eval fieldnames = if(<<FIELD>>=="splunkd", mvappend(fieldnames, "<<FIELD>>"), fieldnames)]
| stats values(fieldnames)

For me that yields series (from metrics logs) and sourcetype (obvious).